Exporting Log Data

Seq uses a newline-delimited JSON format for import and export of log data.

Log data can be exported from a Seq server in one of three ways.

Export via the API with seqcli search --json

The seqcli command-line client is usually the nicest way to work.

Events are exported using seqcli search with the --json argument specified:

seqcli search -c 1000000000 --json --filter="Application = 'Ordering'"

The command accepts a variety of arguments to control which data is exported (run seqcli help search to see them all).

Events are written to STDOUT; to save them to a file, use redirection:

seqcli search -c 1000000000 --json --filter="Application = 'Ordering'" > ordering.clef

seqcli is installed and placed on the path by default when installing Seq on Windows. Other downloads and documentation are at: https://github.com/datalust/seqcli.

The tool is built on the HTTP API and the underlying code is in the Seq.Api NuGet package (C#), so if your task is programmatic that can be used directly instead.

Export in real-time using Seq.App.JsonArchive

Another alternative, if it's an ongoing process, is to install the Seq.App.JsonArchive extension and set up a continuous JSON export into a shared folder.

The app will export newline-formatted JSON files in a configurable chunk size.

With the app installed, configure an instance with the Stream incoming events option to export event data as it arrives.

Bulk export using flaretl.exe

The flaretl tool, installed to C:\Program Files\Seq\Native on Windows, and included at /bin/seq-server/Native in the Docker container, is the fastest way to export events (one or more orders of magnitude faster than the other options).

Unlike the first two possibilities, flaretl requires that the store is "cold", that is, the Seq server is stopped and no other process is accessing the stream data.

seq service stop
& "C:\Program Files\Seq\Native\flaretl.exe" export "C:\ProgramData\Seq\Stream" > export.clef
seq service start